Splunk Search

How to convert string data in a field to proper case?

New Member

I'm trying to convert string data in my fields to proper case e.g. josh smith to Josh Smith. Is there any function in Splunk that can do this out of the box? I know there are easy ways to convert to lower and upper but I haven't found anything that will let me convert to proper case.

0 Karma
1 Solution

Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

View solution in original post

Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

View solution in original post

Motivator

What is the purpose of the first and last parts with "^" and "^." ?

Esteemed Legend

It was a hack.
The s/^/ / forces the beginning of the string to contain a leading space so that the middle things can correctly determine the beginning of a word being a space followed by anything else. The last s/^.//, which could have been written as s/^ //, is to undo the hack after the middle stuff is done. When stringing SED it goes from left to right.

0 Karma

Champion

Hi @drewski,

you can use below as a macro. you just need to pass the field which you want to convert.

Note: It works only for two words and result of this will be word starts with capital letter and single eval is used.

|  makeresults
| eval name="PawaN KaLyaN" 
| eval name = lower(name)
| eval name=upper(substr(mvindex(split(name," "),0),0,1)).substr(mvindex(split(name," "),0),2)." ".upper(substr(mvindex(split(name," "),1),0,1)).substr(mvindex(split(name," "),1),2)

Happy Splunking...

————————————
If this helps, give a like below.
0 Karma

New Member

Thanks for your response. Unfortunately I'm not guaranteed to only get FN LN so I need to develop a more robust solution.

0 Karma

Splunk Employee
Splunk Employee

This isn't a function, but here is an example of how you might do accomplish this.

< YOUR BASE SEARCH> 
| eval name="kevin morris" 
| rex field=name "^(?P<first>\w+)\s(?P<last>\w+)" 
| rex field=first "^(?P<ffirst>.)(?P<lfirst>.*)" 
| rex field=last "^(?P<flast>.)(?P<llast>.*)" 
| eval fullname = upper(ffirst) . lfirst . " " . upper(flast) . llast 
| table fullname
0 Karma

SplunkTrust
SplunkTrust

AFAIK, there is no direct/native way to do so in Splunk.

0 Karma